Adaptive access control management

Abstract

Systems, methods, and related technologies for access control management are described. The access control management may be customized for an entity and be configured on an enforcement point closest to the entity. In certain aspects, an entity communicatively coupled to a network is selected and one or more characteristics of the entity determined. An access policy may be selected based on the one or more characteristics of the entity and one or more enforcement points closest to the entity determined. One or more access rules to be assigned to the one or more enforcement points based on the access policy may be determined and the one or more access rules assigned to or configured on the one or more enforcement points closest to the entity.

What is claimed is: 
     
       1. A method comprising:
 selecting an entity communicatively coupled to a network; 
 monitoring network traffic associated with the entity; 
 determining one or more characteristics of the entity based on the network traffic associated with the entity; 
 selecting an access policy based on the one or more characteristics of the entity; 
 determining one or more enforcement points closest to the entity based on the network traffic; 
 retrieving configuration information from the one or more enforcement points; 
 translating the configuration information into current access rules of the one or more enforcement points; 
 determining, by a processing device, one or more new access rules to be assigned to the one or more enforcement points based on the access policy, the current access rules, and the one or more characteristics of the entity, wherein the one or more new access rules are configured to control network access in a manner customized for the entity comprising applying the one or more new access rules on a per entity basis; 
 applying the one or more new access rules to the one or more enforcement points closest to the entity, wherein the one or more new access rules enforce the access policy at the one or more enforcement points; and 
 verifying assignment of the one or more new access rules to the one or more enforcement points closest to the entity. 
 
     
     
       2. The method of  claim 1 , wherein the one or more new access rules are assigned to the one or more enforcement points based on a port associated with the entity. 
     
     
       3. The method of  claim 1 , wherein the one or more characteristics of the entity are determined without use of an agent. 
     
     
       4. The method of  claim 1 , wherein the entity is selected based on being detected communicatively coupling to the network. 
     
     
       5. The method of  claim 1 , wherein the one or more characteristics of the entity include at least one of an identification of the entity, a classification of the entity, location, a user, compliance, or risk. 
     
     
       6. The method of  claim 1 , wherein the one or more enforcement points comprise at least one of a firewall, a router, a switch, a portion of cloud infrastructure, hypervisor, software-defined networking (SDN) controller, or virtual firewall. 
     
     
       7. The method of  claim 1 , wherein the one or more new access rules are configured using at least one of an application programming interface (API), command line interface (CLI), or a simple network management protocol (SNMP) interface. 
     
     
       8. The method of  claim 1 , wherein the one or more new access rules are associated with a destination of communications sent from the entity. 
     
     
       9. The method of  claim 1 , wherein the one or more new access rules assigned to an enforcement point comprises at least one of an access control list (ACL), a switch command, or rule or a cloud packet filtering ACL. 
     
     
       10. The method of  claim 1 , wherein the entity comprises at least one of a device, an endpoint, a virtual machine, a service, a serverless service, a container, or a user. 
     
     
       11. A system comprising:
 a memory; and 
 a processing device, operatively coupled to the memory, to:
 select an entity communicatively coupled to a network; 
 monitor network traffic associated with the entity; 
 determine one or more characteristics of the entity based on the network traffic associated with the entity; 
 select an access policy based on the one or more characteristics of the entity; 
 determine one or more enforcement points closest to the entity based on the network traffic; 
 retrieve configuration information from the one or more enforcement points; 
 translate the configuration information into current access rules of the one or more enforcement points; 
 determine one or more new access rules to be assigned to the one or more enforcement points based on the access policy, the current access rules, and the one or more characteristics of the entity, wherein the one or more new access rules are configured to control network access in a manner customized for the entity comprising applying the one or more new access rules on a per entity basis; 
 apply the one or more new access rules to the one or more enforcement points closest to the entity, wherein the one or more new access rules enforce the access policy at the one or more enforcement points; and 
 verify assignment of the one or more new access rules to the one or more enforcement points closest to the entity. 
 
 
     
     
       12. The system of  claim 11 , wherein the one or more new access rules are assigned to the one or more enforcement points based on a port associated with the entity. 
     
     
       13. The system of  claim 11 , wherein the one or more characteristics of the entity are determined without use of an agent. 
     
     
       14. The system of  claim 11 , wherein the one or more characteristics of the entity include at least one of an identification of the entity, a classification of the entity, location, a user, compliance, or risk. 
     
     
       15. A non-transitory computer readable medium having instructions encoded thereon that, when executed by a processing device, cause the processing device to:
 select an entity communicatively coupled to a network; 
 monitor network traffic associated with the entity; 
 determine one or more characteristics of the entity based on the network traffic associated with the entity; 
 select an access policy based on the one or more characteristics of the entity; 
 determine one or more enforcement points closest to the entity based on the network traffic; 
 retrieve configuration information from the one or more enforcement points; 
 translate the configuration information into current access rules of the one or more enforcement points; 
 determine, by the processing device, one or more new access rules to be assigned to the one or more enforcement points based on the access policy, the current access rules, and the one or more characteristics of the entity, wherein the one or more new access rules are configured to control network access in a manner customized for the entity comprising applying the one or more new access rules on a per entity basis; 
 apply the one or more new access rules to the one or more enforcement points closest to the entity, wherein the one or more new access rules enforce the access policy at the one or more enforcement points; and 
 verify assignment of the one or more new access rules to the one or more enforcement points closest to the entity. 
 
     
     
       16. The non-transitory computer readable medium of  claim 15 , wherein the one or more new access rules are assigned to the one or more enforcement points based on a port associated with the entity.